@sema-agent/core 7.21.1 → 7.23.0

package/dist/core/path-identity.d.ts

@@ -3,11 +3,18 @@ import { type PathFamily } from "../tools/fs/safety.js";
 /**
  * Every spelling the leaf symlink chain of `path` passes through, or `[]`.
  *
- * `[]` has ONE reading — nothing to judge beyond the spelling and the terminal — reached three ways that are
- * deliberately the same word: no `canonicalChain` declared, `ok: false`, or an empty chain. An unanswerable
- * chain is never a refusal: the terminal's own canonicalization already refuses what it cannot resolve, and a
+ * `[]` has ONE reading for the VERDICT — nothing to judge beyond the spelling and the terminal — reached four
+ * ways that are deliberately the same word: no `canonicalChain` declared, a refused namespace spelling, an
+ * empty chain, and the environment answering `ok: false`. An unanswerable chain is never a refusal: this
+ * reader's callers are path guards whose own absence law says a view that cannot answer does not vote, and a
  * second refusal law over one target would be a second rule. The spelling is anchored as the canonicalizer
  * anchors it (`baseCwd`). A refused namespace spelling and a win-form UNC spelling are not walked (the reference
  * CLI's variant set stops at a network spelling); the share is recognized by the throat's own `isUncSpelling`.
+ *
+ * `onUnanswerable` separates ONE of those four from the rest for a caller that DISCLOSES its absent views: the
+ * environment was ASKED and could not answer (`ok: false`), which is a fact about that environment. The other
+ * three are not failures — nothing was asked, or the answer was genuinely "no hops" — so they stay silent. The
+ * verdict is `[]` either way; this sink changes nothing about what is judged, only what is said out loud. A
+ * throwing sink is the caller's bug and is not caught here.
  */
-export declare function symlinkChainHops(env: ExecutionEnv, path: string, signal: AbortSignal | undefined, family: PathFamily, baseCwd?: string): Promise<readonly string[]>;
+export declare function symlinkChainHops(env: ExecutionEnv, path: string, signal: AbortSignal | undefined, family: PathFamily, baseCwd?: string, onUnanswerable?: (cause: string) => void): Promise<readonly string[]>;

package/dist/core/path-identity.js

@@ -1,5 +1,5 @@
 import { isAbsoluteForFamily, isUncSpelling, joinForFamily, win32NamespaceScreen } from "../tools/fs/safety.js";
-export async function symlinkChainHops(env, path, signal, family, baseCwd) {
+export async function symlinkChainHops(env, path, signal, family, baseCwd, onUnanswerable) {
     if (typeof env.canonicalChain !== "function")
         return [];
     const screened = win32NamespaceScreen(path, family);
@@ -10,5 +10,8 @@ export async function symlinkChainHops(env, path, signal, family, baseCwd) {
         return [];
     const target = baseCwd !== undefined && baseCwd.length > 0 && !isAbsoluteForFamily(family, spelled) ? joinForFamily(family, baseCwd, spelled) : spelled;
     const chain = await env.canonicalChain(target, signal);
-    return chain.ok ? chain.value.hops : [];
+    if (chain.ok)
+        return chain.value.hops;
+    onUnanswerable?.(chain.error.message);
+    return [];
 }

package/dist/core/permission-rule-model.d.ts

@@ -1195,8 +1195,7 @@ export declare function suggestRulesForCommand(command: string, ctx?: {
      * design/382 §2.4-6 — the deployment's sensitive-read negative control, SAME-SOURCE with its
      * compiled read-deny judge (`ReadDenyMatcher.matchPath !== null` is the canonical wiring): the
      * engine never PROPOSES a directory authorization for a directory this judge names. Absent ⇒
-     * the built-in default deny table stands in (refusal-only; a deployment with a wired judge
-     * passes its own so the two faces cannot disagree). Explicit-consent doors (hand-written,
+     * {@link defaultDeniesDirectoryRead} stands in (refusal-only; every hands leg passes its OWN judge). Explicit-consent doors (hand-written,
      * import) are deliberately NOT behind this — they have their own preview and validation.
      */
     readonly deniesDirectoryRead?: (directory: string) => boolean;

package/dist/core/read-root-candidate.js

@@ -20,5 +20,15 @@ export function normalizeReadRootCandidate(value) {
         return undefined;
     if (!win32NamespaceScreen(dir, pathFamilyOf({ root: dir })).ok)
         return undefined;
-    return { dir, clearsThisAsk: true };
+    let covers;
+    try {
+        const d = Object.getOwnPropertyDescriptor(value, "covers");
+        covers = d === undefined ? "absent" : "value" in d && d.value === "exact" ? "exact" : "refuse";
+    }
+    catch {
+        covers = "refuse";
+    }
+    if (covers === "refuse")
+        return undefined;
+    return covers === "exact" ? { dir, clearsThisAsk: true, covers: "exact" } : { dir, clearsThisAsk: true };
 }

package/dist/core/retention.d.ts

@@ -47,7 +47,7 @@ export interface ManagedRetentionCapability {
     /** Lineage-aware transcript/session deletion: a session tree is deleted only when no live
      *  reference (fork child, background child, workflow run, pending checkpoint) still points into
      *  it — references are re-checked inside the deletion transaction, never assumed from a prior
-     *  scan. */
+     *  scan; {@link RETENTION_CASCADE_EXEMPT} is never deleted with one. */
     deleteExpiredSessions(input: {
         domain: string;
         cutoffMs: number;
@@ -66,6 +66,13 @@ export interface ManagedRetentionCapability {
  * own occurrence id, operation, and timestamp inside the deleting transaction. Adding those here
  * would ask a return value to know its own call context.
  */
+/** @contract retention.cascade_domains — a managed-retention cascade deletes checkpoint rows,
+ *  session trees (transcripts and lineage) and orphan tool results; nothing else is session data. */
+export declare const RETENTION_CASCADE_DOMAINS: readonly ["checkpoints", "session-trees", "orphan-tool-results"];
+/** @contract retention.governance_records_outlive_the_purge — the pollution marker dir, the capture
+ *  opt-out record dir and the lineage ledger are governance FACTS about content that exists, not
+ *  session data: deleting them makes a one-way privacy record revocable. */
+export declare const RETENTION_CASCADE_EXEMPT: readonly ["session-pollution", "session-capture-optout", "lineage.json"];
 export interface RetentionReceipt {
     domain: string;
     /** Rows destroyed by THIS call (idempotent retries count already-gone rows as 0, not errors). */

package/dist/core/retention.js

@@ -1,3 +1,5 @@
+export const RETENTION_CASCADE_DOMAINS = ["checkpoints", "session-trees", "orphan-tool-results"];
+export const RETENTION_CASCADE_EXEMPT = ["session-pollution", "session-capture-optout", "lineage.json"];
 function codedError(code, message) {
     const e = new Error(message);
     e.code = code;

package/dist/core/runner/assemble-result.d.ts

@@ -1,4 +1,5 @@
 import type { AssistantMessage } from "../../internal/llm.js";
+import type { HumanReviewGateRow } from "../task-result.js";
 import type { NestedUsage, PausedCause, TaskResult, TaskSpec, TerminalCause } from "../types.js";
 import type { HaltConsumption } from "../../internal/harness.js";
 /** Per-task usage/cost accumulator (filled across the run loop, surfaced as `TaskResult.stats`). */
@@ -40,13 +41,7 @@ export interface Stats {
     humanReview?: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-            toolName?: string;
-            toolArg?: string;
-        }>;
+        gates: HumanReviewGateRow[];
     };
     /** TB telemetry B2: engine-mechanism engagement counters. Set by the run loop
      *  only when ≥1 engaged; flows straight through to `TaskResult.stats.mechanisms` via the

package/dist/core/runner/assemble-result.js

@@ -2,6 +2,7 @@ import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { extractErrorCode, stripErrorCodePrefix } from "../../brain/errors.js";
 import { terminalProjection } from "./terminal-projection.js";
 import { haltConsumed } from "./halt-attribution.js";
+import { describeRejectedValue } from "../tool-search-setting.js";
 const SALVAGE_ELIGIBLE_TERMINALS = new Set([
     "output.degenerate",
     "limits.max_tokens_exceeded",
@@ -11,18 +12,34 @@ const SALVAGE_ELIGIBLE_TERMINALS = new Set([
     "env.lifetime_expired",
     "usage.window_exhausted",
 ]);
+function thrownMessage(threw) {
+    try {
+        if (threw instanceof Error) {
+            const m = threw.message;
+            if (typeof m === "string")
+                return m;
+        }
+    }
+    catch {
+    }
+    return describeRejectedValue(threw);
+}
 export function errorCodeOf(err) {
     let cur = err;
     let fallback;
-    for (let depth = 0; cur && typeof cur === "object" && depth < 8; depth++) {
-        const code = cur.code;
-        if (typeof code === "string" && code) {
-            if (code !== "unknown") {
-                return code;
+    try {
+        for (let depth = 0; cur && typeof cur === "object" && depth < 8; depth++) {
+            const code = cur.code;
+            if (typeof code === "string" && code) {
+                if (code !== "unknown") {
+                    return code;
+                }
+                fallback ??= code;
             }
-            fallback ??= code;
+            cur = cur.cause;
         }
-        cur = cur.cause;
+    }
+    catch {
     }
     return fallback;
 }
@@ -84,7 +101,7 @@ export function terminalCauseOf(final, stats, flags) {
         terminal = { kind: "failed", code: "suspend.loop", message };
     }
     else if (flags.threw) {
-        const message = flags.threw instanceof Error ? flags.threw.message : String(flags.threw);
+        const message = thrownMessage(flags.threw);
         const code = flags.abortedForTimeout
             ? "limits.max_walltime_exceeded"
             : flags.abortedForTurns

package/dist/core/runner/classifier-ladder.js

@@ -217,6 +217,7 @@ export function classifierRoundObserver(args) {
             ms: info.ms,
             verdict: info.verdict,
             ...(info.cause !== undefined ? { cause: info.cause } : {}),
+            ...(info.notAsked !== undefined ? { notAsked: info.notAsked } : {}),
             ts: Date.now(),
         }));
         announceFallback(info.classifier);

package/dist/core/runner/contracts.d.ts

@@ -13,6 +13,7 @@
  * without adding a runtime edge anywhere. The blocks below are verbatim moves, in their original
  * order, JSDoc included, so the move stays auditable as a move.
  */
+import type { HumanReviewGateRow } from "../task-result.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { BrainCallGuardrailRef } from "../../brain/timeout.js";
@@ -248,6 +249,11 @@ export interface Prepared {
     thinking?: ThinkingLevel;
     compModel?: Model;
     mcp: MaterializedMcp;
+    /** The run handle's `reconnectMcpServer` implementation — {@link MaterializedMcp.reconnect} plus the
+     *  live-roster application and the operator disclosure, which are runner concerns and not the MCP
+     *  handle's. Present only when this leg DECLARED MCP servers; the stream verb's seat stays unbound
+     *  otherwise and it refuses typed. */
+    mcpRedial?: (server: string) => Promise<import("../mcp.js").McpReconnectResult>;
     /** Present only when `spec.a2a` declared peers — the run loop owes it the same end-of-task dispose
      *  it owes {@link mcp} (no sockets are held, but a disposed mount is what makes a post-task tool
      *  call refuse loudly instead of dialing a peer on a dead task's behalf). */
@@ -783,16 +789,14 @@ export interface Prepared {
      *  prior-leg burden seeded from the resumed checkpoint). The run loop ADDS the durable-resume latency
      *  (`now() − cp.suspendedAt`) on a resume, then surfaces it as `stats.humanReview` at assembly (omitted when
    *  empty). **Budget-EXCLUDED** — never folded into cost/the budget gate. */
+    /** borrowed-mutable — the hands' read-state map (the SAME `Map` object the toolkit and the context
+     *  lane hold; absent without hands). Read by the provider-rejection recovery arm so its stale-result
+     *  clears retire the entries those transmissions fed, through the same landing the frontier pass uses. */
+    readFileState?: import("../../tools/fs/safety.js").ReadFileState;
     humanReviewRef: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-            toolName?: string;
-            toolArg?: string;
-        }>;
+        gates: HumanReviewGateRow[];
     };
     /** The injectable wall-clock the run loop uses for the durable-resume human-review latency
      *  (`humanLatencyMs = now() − cp.suspendedAt`), so it reads the SAME clock as the suspend-side `suspendedAt`. */
@@ -908,7 +912,14 @@ export interface Prepared {
      *  that were re-attached WHOLE. Present only with hands (same gate as readTaskFile).
      *  `preserveReadState` carries the kept-tail-visible files that were
      *  deliberately skipped for re-attachment — their existing entry must survive the clear too (same
-     *  reasoning as a seeded entry: the model's view of the file did not change). */
+     *  reasoning as a seeded entry: the model's view of the file did not change).
+     *
+     *  SCOPE — read "every compaction lane" as exactly that and no wider. The request-layer
+     *  stale-result pass takes a Read body off the wire with no compaction at all, and retires its own
+     *  entries at its own landing site (`prepare-context-lane.ts`'s `landStaleResultClears`) through the
+     *  SAME function this seat calls, on its `tool-results-cleared` arm: ONE retirement mechanism, two
+     *  ways for content to leave. Taken as a claim about every SHRINK mechanism this sentence was true
+     *  of the lanes it named and silently false of the one it did not. */
     onCompactionApplied?: (attachedComplete: ReadonlyArray<{
         path: string;
         content: string;
@@ -1184,13 +1195,7 @@ export interface PrepareResume {
     priorHumanReview?: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-            toolName?: string;
-            toolArg?: string;
-        }>;
+        gates: HumanReviewGateRow[];
     };
     /** When the suspend ran with a remote workspace, the {@link CheckpointState.workspaceHandle}
      *  to restore — prepare rebuilds the per-task env via `deps.executionEnvFactory` then `resumeVM(snapshotId)`
@@ -2659,6 +2664,12 @@ export interface CaptureOptOutRef {
         outcome: "created" | "existed";
     }>;
 }
+/** The MCP re-dial verb's binding; bound only when the run declared MCP servers — a leg with
+ *  none has nothing to re-dial, and the stream verb then refuses TYPED rather than answering about a
+ *  materialization that was never made. Same shape and same law as {@link CaptureOptOutRef}. */
+export interface McpRedialRef {
+    redial?: (server: string) => Promise<import("../mcp.js").McpReconnectResult>;
+}
 /**
  * The stream's LIVE state as the verb lanes read it — a view over the driver's own locals (getters, and one
  * setter), never a copy: `resultValue` is written by the run body's `setResult` callback and by the failure

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -1,3 +1,4 @@
+import type { HumanReviewGateRow } from "../task-result.js";
 import { type OnAsk, type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 /** JSON.stringify throws on a cyclic value (a deployment
  *  policy's rewrite object carries no acyclicity guarantee) — `undefined` here means "no comparable
@@ -37,11 +38,5 @@ export declare function consumeInheritedAskGrant(grants: Map<string, {
 }>, onAsk: OnAsk | undefined, humanReviewRef: {
     count: number;
     totalWaitMs: number;
-    gates: Array<{
-        kind: string;
-        waitMs: number;
-        decision?: string;
-        toolName?: string;
-        toolArg?: string;
-    }>;
+    gates: HumanReviewGateRow[];
 }, decision: PermissionResult, req: ToolCallRequest): ResolvedAsk | undefined;

package/dist/core/runner/inherited-ask-grants.js

@@ -23,6 +23,7 @@ export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision
         waitMs: grant.waitMs,
         decision: "allow",
         toolName: req.toolName,
+        toolCallId: req.toolCallId,
         ...(toolArg !== undefined ? { toolArg } : {}),
     });
     const reused = { action: "allow", presentedInput: grant.presented };

package/dist/core/runner/mcp-redial.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The LIVE MCP roster lane: applying one server's intake result to a RUNNING roster, and the
+ * host-driven re-dial that is the second caller of it.
+ *
+ * Two faces change a task's MCP roster after prepare has finished — the model's `RefreshMcpTools`
+ * tool and the run handle's `reconnectMcpServer` verb — and what they must do to the roster is the
+ * same list in the same order: drop the deployment-excluded names, re-fold the safety axes (with the
+ * non-monotone restore arm on refusal), replace the server's whole name-prefix domain at its own
+ * anchor, rebuild the harness toolset, and re-mint the roster delta. That list lived inside the
+ * refresh tool's execute closure, where the second face could only have copied it; a copy would have
+ * been a second answer to "what does a mid-task roster change consist of".
+ *
+ * It is machinery, not a phase: the protocol-tools phase reaches DOWN for it to build the refresh
+ * tool, and the run's verb wiring reaches down for the same functions.
+ */
+import type { AgentTool } from "../../internal/harness.js";
+import type { McpDroppedTool, McpReconnectResult, MaterializedMcp, McpToolAxis } from "../mcp.js";
+import type { RunnerDeps, ToolEffect } from "../types.js";
+import type { IrreversibilityTier, ToolFaceSnapshot } from "./contracts.js";
+import type { RosterBuilder, ToolRosterDeltaSeat } from "../tool-roster.js";
+/** One server's assertion about its own prefix domain — the shape both faces reduce to. `tools` is
+ *  the roster the domain must END UP with (empty withdraws it); `added`/`removed` are the reporting
+ *  half and never drive the swap. */
+export interface McpRosterDelta {
+    server: string;
+    prefix: string;
+    tools: AgentTool[];
+    axes: McpToolAxis[];
+    dropped: McpDroppedTool[];
+}
+/** The seats a roster application writes through. Every one of them is borrowed from the phase that
+ *  minted it — this module owns nothing. */
+export interface McpRosterApplyInput {
+    /** borrowed-readonly — the frozen tool face; `exclude` keeps a deployment-excluded tool from ever
+     *  being re-mounted by a face the model or a host can trigger. */
+    toolFaceSnapshot: Pick<ToolFaceSnapshot, "exclude">;
+    /** borrowed-readonly — the per-server face overlay (the phase's `withFaces`). */
+    withFaces: (tools: AgentTool[], server: string) => AgentTool[];
+    /** borrowed-readonly — the large-result wrapper every protocol tool is mounted through. */
+    remoteToolOffload: (tool: AgentTool) => AgentTool;
+    /** borrowed-readonly — the phase's axis fold (throws on a config contradiction). */
+    foldProtocolAxes: (axes: McpToolAxis[], label: string) => void;
+    /** borrowed-mutable — the two NON-MONOTONE tables the fold writes and this applier snapshots. */
+    toolEffects: Map<string, ToolEffect>;
+    axisExplicitNegatives: Map<string, {
+        irreversible?: false;
+        egress?: false;
+    }>;
+    /** borrowed-mutable — the run's shared roster. */
+    roster: RosterBuilder;
+}
+/** What one application did, for the caller's receipt. `applied:false` means the axis fold refused
+ *  and the domain was left exactly as it was (the tables restored) — no roster write happened. */
+export type McpRosterApplyOutcome = {
+    applied: true;
+    pushed: number;
+    excluded: string[];
+} | {
+    applied: false;
+    foldError: string;
+};
+/**
+ * Apply one server's delta to the live roster. Behavior-identical to the body this was extracted
+ * from; the comments are the extracted reasoning, not new claims.
+ */
+export declare function applyMcpRosterDelta(input: McpRosterApplyInput, delta: McpRosterDelta): McpRosterApplyOutcome;
+/** The seats the post-application commit writes through. */
+export interface McpRosterCommitInput {
+    rebuildHarnessToolsRef: {
+        current?: () => Promise<void>;
+    };
+    rosterSeat: ToolRosterDeltaSeat;
+    toolCallGateArmedRef: {
+        armed: boolean;
+    };
+    irreversibleTools: ReadonlySet<string>;
+    egressTools: ReadonlySet<string>;
+}
+/**
+ * Publish whatever the applications above changed: rebuild the harness toolset (the content-origin
+ * re-wrap runs inside it), then re-mint the roster delta so the stream's rows describe the LIVE
+ * objects. Batched deliberately — a refresh spanning several servers rebuilds once.
+ *
+ * Returns the gate-honesty line when one is due. The built-in integrity policies are composed
+ * UNCONDITIONALLY, so `armed` is always true in this engine and the line never fires today; the arm
+ * stays as a zero-cost guard for a refactor that would make the composition conditional.
+ */
+export declare function commitMcpRosterChanges(input: McpRosterCommitInput): Promise<string | undefined>;
+/** The re-dial's own seats: the handle it drives, the two operator sinks, and the run identity the
+ *  disclosure names. */
+export interface McpRedialInput extends McpRosterApplyInput, McpRosterCommitInput {
+    mcp: MaterializedMcp;
+    deps: Pick<RunnerDeps, "onError" | "onNotice">;
+    sessionId: string;
+    runId: string;
+    irreversibilityTier: IrreversibilityTier;
+}
+/**
+ * The run handle's `reconnectMcpServer` verb, phase-side: re-dial one server, put whatever it
+ * asserted about its prefix domain onto the live roster, and disclose.
+ *
+ * The roster is written IFF the result carries `tools` — the one rule this lane reads. That covers
+ * both directions with no second condition: a successful re-dial asserts its fresh roster, a failed
+ * DIAL asserts the empty one (the connection it tore down is gone, so leaving its names mounted would
+ * leave the model holding tools that can only fail), and an arm that never touched the connection —
+ * unknown name, revoked server, re-dial already in flight, disposed materialization — asserts nothing
+ * and the mounted roster is left alone.
+ */
+export declare function redialMcpServer(input: McpRedialInput, server: string): Promise<McpReconnectResult>;

package/dist/core/runner/mcp-redial.js

@@ -0,0 +1,60 @@
+import { deliverEngineNotice } from "../types.js";
+export function applyMcpRosterDelta(input, delta) {
+    const { toolFaceSnapshot, withFaces, remoteToolOffload, foldProtocolAxes, toolEffects, axisExplicitNegatives, roster } = input;
+    const excludedSet = new Set(toolFaceSnapshot.exclude ?? []);
+    const pushable = delta.tools.filter((t) => !excludedSet.has(t.name));
+    const excluded = delta.tools.filter((t) => excludedSet.has(t.name)).map((t) => t.name);
+    const domainSnapshot = (m) => new Map([...m].filter(([name]) => name.startsWith(delta.prefix)));
+    const restoreDomain = (m, snap) => {
+        for (const name of [...m.keys()])
+            if (name.startsWith(delta.prefix))
+                m.delete(name);
+        for (const [name, v] of snap)
+            m.set(name, v);
+    };
+    const priorDomainEffects = domainSnapshot(toolEffects);
+    const priorDomainNegatives = domainSnapshot(axisExplicitNegatives);
+    for (const name of priorDomainEffects.keys())
+        toolEffects.delete(name);
+    for (const name of priorDomainNegatives.keys())
+        axisExplicitNegatives.delete(name);
+    try {
+        foldProtocolAxes(delta.axes.filter((a) => !excludedSet.has(a.name)), "MCP");
+    }
+    catch (foldErr) {
+        restoreDomain(toolEffects, priorDomainEffects);
+        restoreDomain(axisExplicitNegatives, priorDomainNegatives);
+        return { applied: false, foldError: foldErr instanceof Error ? foldErr.message : String(foldErr) };
+    }
+    roster.replaceDomain(delta.prefix, withFaces(pushable, delta.server).map((t) => remoteToolOffload(t)), { source: "mcp", mountedBy: "optional", origin: { peer: delta.server } });
+    return { applied: true, pushed: pushable.length, excluded };
+}
+export async function commitMcpRosterChanges(input) {
+    await input.rebuildHarnessToolsRef.current?.();
+    input.rosterSeat.republish();
+    if (!input.toolCallGateArmedRef.armed && (input.irreversibleTools.size > 0 || input.egressTools.size > 0)) {
+        return "WARNING: refreshed tools declare irreversible/egress safety hints, but this task started with no approval gate registered (no policy/hooks and no gated tools at start) — these hints cannot arm a gate mid-task (RB-46); the refreshed tools run ungated on this deployment shape.";
+    }
+    return undefined;
+}
+export async function redialMcpServer(input, server) {
+    const result = await input.mcp.reconnect(server);
+    if (result.tools !== undefined) {
+        const outcome = applyMcpRosterDelta(input, { server: result.server, prefix: result.prefix, tools: result.tools, axes: result.axes ?? [], dropped: result.dropped ?? [] });
+        if (!outcome.applied)
+            input.deps.onError?.(Object.assign(new Error(`MCP re-dial of "${server}" connected but its safety-axis fold refused, so its tools were not mounted: ${outcome.foldError}`), { code: "mcp.server_unavailable" }), { phase: "mcp", sessionId: input.sessionId });
+        const ungated = await commitMcpRosterChanges(input);
+        if (ungated !== undefined)
+            input.deps.onError?.(Object.assign(new Error(ungated), { code: "mcp.server_unavailable" }), { phase: "mcp", sessionId: input.sessionId });
+    }
+    for (const w of result.warnings ?? [])
+        input.deps.onError?.(Object.assign(new Error(w), { code: "mcp.server_unavailable" }), { phase: "mcp", sessionId: input.sessionId });
+    deliverEngineNotice(input.deps.onNotice, {
+        code: "mcp.server_redialed",
+        message: result.outcome === "reconnected"
+            ? `MCP server "${server}" was re-dialed at the host's request: ${result.toolCount} tool${result.toolCount === 1 ? "" : "s"} mounted (${result.added.length} added, ${result.removed.length} removed)`
+            : `MCP server "${server}" was NOT re-dialed (${result.outcome})${result.reason !== undefined ? `: ${result.reason}` : ""}`,
+        detail: { server, outcome: result.outcome, added: result.added.length, removed: result.removed.length, ...(result.reason !== undefined ? { reason: result.reason } : {}), sessionId: input.sessionId, runId: input.runId },
+    });
+    return result;
+}

package/dist/core/runner/memory-consolidation-driver.d.ts

@@ -94,6 +94,8 @@ export declare const AUTO_RUN_ON_RECOMMENDATION_DEFAULT = true;
  *    switch wired AND a model seat resolvable) — the reference CLI's "auto-dream: off while
  *    auto-memory is off": a default-on world must not arm a deployment that wired no consolidation;
  *  - any other value ⇒ off (never arm on garbage; the door refuses it at prepare anyway).
+ *
+ * @contract memory.auto_consolidation.arming_has_one_resolver — whether a deployment's automatic consolidation is armed is answered here and nowhere else, a host that merely DISPLAYS the arming included: an ABSENT seat is not "off" (it reads the named default, and only where both seats are wired), so a reader branching on `RunnerDeps.autoRunOnRecommendation` alone is wrong in BOTH directions — it calls a default-armed deployment unarmed and a deployment with no consolidation armed. A deployment fact, never a per-session one; exported from the package root for that reason.
  */
 export declare function autoRunOnRecommendationEffective(deps: MemoryConsolidationDriverDeps & {
     autoRunOnRecommendation?: unknown;

package/dist/core/runner/prepare-ask-lane.js

@@ -115,6 +115,7 @@ export function prepareAskLane(input) {
                 waitMs,
                 decision: resolved.action === "allow" ? "allow" : "deny",
                 toolName: req.toolName,
+                toolCallId: req.toolCallId,
                 ...(toolArg !== undefined ? { toolArg } : {}),
             });
         }

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -7,7 +7,7 @@ import { isSelfOrchestrationActive } from "../../orchestration/workflow-script-r
 import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
-import { autoModeClassifierFallbackOf, autoModeRoundNotAsked, createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
+import { autoModeClassifierFallbackOf, createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
 import { checkpointStoreOfSeat } from "../checkpoint-seat.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, resolveComplianceDenies } from "../compliance.js";
 import { createPresentPlanTool, createEnterPlanModeTool } from "../present-plan-tool.js";
@@ -207,27 +207,24 @@ export async function prepareCapsAndWorkflow(input) {
         const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
         const classifierRuntime = brainToRuntime(deps.brain);
         const classifierRungs = classifierLadderRungs(am.classifierFallback, classifierModel, model);
-        const roundPrompt = new WeakMap();
         autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
         autoModeDecider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
             candidates: classifierRungs.map((m) => m.id),
             onClassified: classifierRoundObserver({ tracer: deps.tracer, onNotice: deps.onNotice, taskId: hostTaskId, seatModelId: classifierModel.id, ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) }),
-            classify: async (input, signal, rung) => {
+            assemble: async (input) => {
+                const ctx = await session.buildContext();
+                const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) && (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
+                return renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
+            },
+            classify: async (_input, signal, rung, userPrompt) => {
                 const rungModel = rung !== undefined ? classifierRungs[rung.index] : undefined;
                 if (rung === undefined || rungModel === undefined) {
                     throw new Error(`the auto-mode classifier was asked at ladder position ${JSON.stringify(rung?.index)}, which this arming did not build`);
                 }
-                let build = rung.index > 0 ? roundPrompt.get(input) : undefined;
-                if (build === undefined) {
-                    build = (async () => {
-                        const ctx = await session.buildContext();
-                        const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) && (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
-                        return renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
-                    })();
-                    roundPrompt.set(input, build);
+                if (userPrompt === undefined) {
+                    throw new Error("the auto-mode classifier was asked with no assembled question, which this arming builds once per classification");
                 }
-                const userPrompt = await build.catch((e) => { throw autoModeRoundNotAsked(e); });
                 const classifierAuth = await spec.getApiKeyAndHeaders?.(rungModel);
                 const request = async (seat, suffix) => {
                     const response = await classifierRuntime.completeSimple(rungModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt + suffix, timestamp: Date.now() }] }, {

package/dist/core/runner/prepare-context-lane.d.ts

@@ -17,11 +17,12 @@
  */
 import { type AgentHarness, type AgentMessage } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
-import { type MicroCompactMachine, type OccurrenceIndex } from "../context-edit.js";
+import { type ClearedProjectionLedger, type MicroCompactMachine, type OccurrenceFingerprint, type OccurrenceIndex } from "../context-edit.js";
 import { type ToolResultStore } from "../tool-result-store.js";
 import { type RunnerDeps } from "../types.js";
 import type { Prepared, PreparedMicroCompact } from "./contracts.js";
 import { type GitStatusLaneRef } from "./git-status-frame.js";
+import type { ReadFileState } from "../../tools/fs/safety.js";
 export interface PrepareContextLaneInput {
     /** borrowed-readonly — the task model: the budgets, the trigger-window geometry and `charsPerToken` are read off it. */
     model: Model;
@@ -56,6 +57,12 @@ export interface PrepareContextLaneInput {
     requestLossyRef: {
         current: boolean;
     };
+    /** borrowed-mutable — the hands' read-state map, or undefined without hands. Writer here: a landed stale-result
+     *  clear RETIRES the entries whose transmission it just replaced with a marker — the same retirement the compaction
+     *  lanes run through the SAME function (`applyContextShrinkToReadFileState`), because a Read body taken off the wire
+     *  is off the wire whichever mechanism took it. Without it a re-read of an unchanged file answers "content omitted"
+     *  pointing at a cleared marker. */
+    readFileState?: ReadFileState;
     /** borrowed-mutable — the trim-pressure flag (`Prepared.trimPressureRef`). Writer here: the guard chain's trim arm sets
      *  `droppedMessages`; the run loop's boundary reads and clears it. */
     trimPressureRef: {
@@ -72,6 +79,38 @@ export interface PrepareContextLaneResult {
 }
 /** The M21 phase body — prepareTask's context-lane stretch, verbatim (see the module header). */
 export declare function prepareContextLane(input: PrepareContextLaneInput): PrepareContextLaneResult;
+/** Record a cc-machine pass's clears into the ledger + emit the G11
+ *  frame (one frame per firing pass; the replay of these markers on later requests emits nothing —
+ *  cardinality is per CLEAR, not per request). `trigger` names the arm: `"frontier"` = the
+ *  proactive request-build pass, `"blocking"` = the slice-3 arm-A pre-guard pass (the machine's
+ *  one shot when the frontier hook is off). Marker bytes are read back off the edited array
+ *  (the machine composed them, ref/media notes included) so the ledger replays EXACTLY what went
+ *  on the wire; an occurrence the index cannot key (pathological same-id-same-timestamp ambiguity)
+ *  is simply not recorded — its clear stays request-local, the safe (full-text-returns) direction.
+ *  `at.fp` is the occurrence's fingerprint in the PRE-CAP replayed view (the same bytes the next
+ *  session rebuild presents) — the replay-side mis-paint guard's comparand. */
+/**
+ * The ONE landing of a set of stale-result clears: the ledger entry that makes the marker survive every
+ * later rebuild, and the retirement of the read-state entries those transmissions carried. The pair is
+ * inseparable — a ledger entry WITHOUT the retirement leaves a dedup stub pointing at a marker — which
+ * is why it is a function rather than two statements repeated at each of the two clear sites (the
+ * frontier/blocking pass and the provider-rejection recovery arm, which used to write the ledger
+ * independently, so only one of them retired anything). Posture: a ledger entry means the marker is
+ * repainted on every later request build, so the occurrence is cleared for good even when the
+ * projection that produced it is discarded — which is why the retirement belongs here and not in the
+ * per-request observation buffer.
+ */
+export declare function landStaleResultClears(args: {
+    ledger: ClearedProjectionLedger;
+    cleared: ReadonlyArray<{
+        key: string;
+        marker: string;
+        groupCount: number;
+        fp: OccurrenceFingerprint;
+        toolCallId?: string;
+    }>;
+    readFileState?: ReadFileState;
+}): void;
 /** See {@link runGuardChain}. */
 export interface GuardChainArgs {
     /** The post-frontier view the chain starts from. */
@@ -94,6 +133,9 @@ export interface GuardChainArgs {
     /** The r7 per-request observation buffer — the chain DROPS it on its early returns (a discarded
      *  provisional projection must not narrate itself). */
     pendingProjectionObservations: Array<() => void>;
+    /** The hands' read-state map, or undefined without hands — arm A's clear retires the entries its
+     *  cleared transmissions carried (see `PrepareContextLaneInput.readFileState`). */
+    readFileState?: ReadFileState;
 }
 export type GuardChainOutcome = {
     earlyReturn: {